How Vista UAC Works with Steve Gibson Security Guru

[darthirakli]

The problem with permissions is that they cannot guarantee that the system will not be infected. A lot of malware can run under restricted rights and still do a lot of damage. Yes, it will not be able to modify system files, etc. But it WILL be able to access, modify and/or delete user files, and may even be able to install a keyloger.

[cphellp]

OSX any one...

[pilot8778]

your lucky then that nothings embedded itself in your system

[vahnx1337]

I never once seen UAC appear out of no-where asking to install some malicious software, so I think UAC is BS.

[aussiebear22]

Not all malware require administrator privileges. Hence the reason why UAC doesn't appear.

To better protect yourself, set up another account that is a "Standard User" and use that instead.

If you have Vista Business or Ultimate, also use "Software Restriction Policy" and set it to "Disallowed" as default. (Remove "LNK" type file from the blacklist).

The only additional thing you need is a Firewall with HIPS (Host based Intrusion Prevention System). To defend against user-level malware.

[vahnx1337]

Would a hardware router have this HIPS?

[aussiebear22]

Feature-packed hardware routers are expensive. (Unless you build your own one using a spare PC and open source based software).

I suggest a Windows based firewall with HIPS.

Examples of Free solutions.

Comodo Firewall Pro => This is a firewall and HIPS in one. It'll require some time to get used to its features.

Threatfire => This is just a HIPS type solution. Its a lot more easier to use, but is less flexible if you're an advanced computer user.

[aussiebear22]

Continued...

Online Armor (Free) => Firewall and HIPS. But the Free version has some protection features cut.

I personally use Comodo Firewall Pro. Its a bit complicated (meaning you need to read the manual for it and actually understand it to get the best protection).

Remember to disable Windows's own Firewall if you use these types of solutions. (Both XP SP2 and Vista have them on by default).